Vulnerabilities

TI-2019-08913 CVE-2019-11887 · GHSA-cr9c-jr9p-hwgx

SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.

MEDIUM 47

SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02314 Published 2019-05-17 No fix listed CWE-434

TI-2019-08580 CVE-2019-11488 · GHSA-hfhv-wm6q-v6xc

Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me…

LOW 38

Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Requ…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0154 Published 2019-04-25 No fix listed CWE-287

TI-2019-08581 CVE-2019-11489 · GHSA-m746-3c43-hv27

Incorrect Access Control in the Administrative Management Interface in SimplyBook.me…

MEDIUM 43

Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-Priv Users to Elevate Privileges to Full Admin Rights via a crafted HTTP PUT Requ…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02516 Published 2019-04-25 No fix listed

Vulnerabilities

Filters

SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.

Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me…

Incorrect Access Control in the Administrative Management Interface in SimplyBook.me…